Article 17 GDPR — enforcement

Cited in 169 decisions · €90.6M total fines · median €8,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (36)

Read Article 17 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-08-26	DSB: Retailer must grant full access and delete data after third-party fraud order	🇦🇹 DSB (Austria)	Art. 61 Art. 6 Art. 145 Art. 14	—
2026-08-12	Datatilsynet ordered Lab Pharma AS to erase influencer's personal data used after	🇳🇴 Datatilsynet (Norway)	Art. 61 Art. 6 Art. 61 Art. 17	€205,000
2026-07-24	HDPA (Greece) - 33/2020	🇬🇷 HDPA (Greece)	Art. 47 Art. 4 Art. 5 Art. 12	€2,000
2026-07-21	CNIL fines EXTIA for failing to properly handle job applicant erasure requests	🇫🇷 CNIL (France)	Art. 12 Art. 17	€300,000
2026-07-18	Garante per la protezione dei dati personali (Italy) - 471/2026	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 5 Art. 51 Art. 51 Art. 6	€20,000
2026-07-17	AEPD (Spain) - EXP202103746	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 12 Art. 15	—
2026-07-09	ANSPDCP (Romania) - Fine against Ascendex Technology SRL	🇷🇴 ANSPDCP (Romania)	Art. 423 Art. 4 Art. 121 Art. 12	€57,839
2026-07-01	Ascendex Technology SRL Insufficient fulfilment of data subjects rights	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 12 Art. 17	€11,000
2026-06-18	Garante per la protezione dei dati personali (Italy) - 476/2026	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 123 Art. 12 Art. 17 Art. 6	€460,000
2026-06-08	Belgian DPA rejects delisting request for US government URL showing criminal conviction	🇧🇪 APD/GBA (Belgium)	Art. 173 Art. 17 Art. 10	—
2026-04-29	Pianeta S.r.l. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€34,000
2026-04-23	Accountancy Firm Insufficient legal basis for data processing	🇧🇪 Belgian Data Protection Authority (APD)	Art. 5 Art. 6 Art. 12 Art. 17	€8,500
2026-04-17	Framos Italia s.r.l. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€5,000
2026-03-04	Slovenian DPA: Controller breached Art. 32, 15 and 34 GDPR over data breach and access	🇸🇮 IP (Slovenia)	Art. 13 Art. 15 Art. 17 Art. 32	—
2026-02-26	Groupharma s.r.l.s. Insufficient fulfilment of data subjects rights	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 15 Art. 17	€3,000
2026-02-12	Sportitalia Società Sportiva Dilettantistica a.r.l. Insufficient fulfilment of data subjects rights	🇮🇹 Italian Data Protection Authority (Garante)	Art. 12 Art. 17	€30,000
2026-02-12	Based s.r.l. Insufficient fulfilment of data subjects rights	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 13 Art. 15	€12,000
2026-02-03	Alliance for the Union of Romanians (AUR) Party Insufficient fulfilment of data subjects rights	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 12 Art. 15 Art. 17 Art. 21	€1,000
2026-01-30	Natural Person Non-compliance with general data processing principles	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 5 Art. 6 Art. 9 Art. 10	€10,000
2025-12-23	Geturhotels Srl Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 17 Art. 24	€6,000
2025-12-23	Geturhotels Srl Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 17 Art. 24	€6,000
2025-11-27	Verisure Italy s.r.l. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 7 Art. 12 Art. 13	€400,000
2025-11-27	Verisure Italy s.r.l. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 7 Art. 12 Art. 13	€400,000
2025-11-26	Cucina di Fabio S.R.L. Insufficient legal basis for data processing	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 6 Art. 15 Art. 17 Art. 25	€3,000
2025-11-26	Cucina di Fabio S.R.L. Insufficient legal basis for data processing	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 6 Art. 15 Art. 17 Art. 25	€3,000

1–25 of 169 next →